CVE-2025-22862 - CVE House

Back to Database

Status published Medium CVE-2025-22862

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288]...

6.3 CVSS

Vulnerability Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their privileges via triggering a malicious Webhook action in the Automation Stitch component.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-22862

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-385

More from Fortinet

View All →

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability...

An improper limitation of a pathname to a restricted directory...

A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer...

A improper certificate validation vulnerability in Fortinet FortiAnalyzer 7.6.0 through...

An Internal Asset Exposed to Unsafe Debug Access Level or...

Affected Vendor

Fortinet

View all reports →

Affected Software

FortiProxy, FortiOS

Vulnerable Versions:

7.6.0, 7.4.0, 7.2.0, 7.0.5, 7.0.6

Timeline

Official Publish: October 2nd, 2025

Last Modified: July 14th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1021 Remote Services

Lateral Movement

T1098 Account Manipulation

Privilege Escalation